SSL/TLS Status and AutoSSL: check certificates before forcing HTTPS

HTTPS requires a certificate valid for the requested hostname. A certificate for one domain does not automatically cover every subdomain, and a padlock alone does not establish that application code is secure.

Check the domain

1. Open SSL/TLS Status or the certificate interface available on your account.
2. Inspect the names, status and expiry information for the site, including www if used.
3. Confirm DNS sends each name to the intended hosting service.
4. If AutoSSL is available, run or await the supported issuance process. Review validation failures rather than repeatedly retrying without changes.
5. Visit the intended public URL and test for mixed content before enabling broad HTTPS redirection.

If issuance fails

Check DNS, restrictive CAA records, domain ownership and whether authentication or redirects obstruct validation. Ask support which certificate authority and validation method are used. Do not remove unrelated DNS records or disable security globally.

Keep private keys private. Avoid pasting them into support chats or storing certificate backups in public folders. Plan renewal monitoring even when issuance is automated. Expired or mismatched certificates should be repaired; visitors should not be taught to bypass browser security warnings.